Tuesday, May 29, 2007

SELinux Tutorial

I have found very few resources for SELinux on the web, which I believe is a idea tool box for the security engineer or for that matter any average Linux user who plans to use programs of the web without examining them for hacks. I have divided up this tutorial into 2 main sections, the first of which describes why SELinux is the coolest security tool ever followed by a detailed tutorial with a running example of getting up and running with it in no time.

SELinux in a Nutshell

The Big challenge is to find ways to have secure systems knowing that flawed application software will always exist. SELinux is an implementation of the reference monitor concept, where the operating system isolates passive resources into distinct objects such as files and active entities such as running programs into subjects. The reference monitor mechanism would then validate access between subjects and object by applying a security policy as embodied in a set of access control rules. Access control decisions are based on security attributes associated with each subject and object. The complexity is a direct result of Linux being complex. There is certainly a trade off in providing a system with the granularity to control every single permission for every object class.

SELinux's MAC vs Linux's DACSecurity-enhanced Linux (SELinux) is an implementation of a mandatory access control mechanism. This mechanism is in the Linux kernel, checking for allowed operations after standard Linux discretionary access controls are checked. Under DAC, ownership of a file object provides potentially risky control over the object. A user can expose a file or directory to a security or confidentiality breach with a misconfigured chmod command and an unexpected propagation of access rights. A process started by that user, such as a CGI script, can do anything it wants to the files owned by the user. A compromised Apache HTTP server can perform any operation on files in the Web group. Malicious or broken software can have root-level access to the entire system, either by running as a root process or using setuid or setgid. In addition under DAC, there are really only two major categories of users, administrators and non-administrators. In order for services and programs to run with any level of elevated privilege, the choices are few and course grained, and typically resolve to just giving full administrator access. Solutions such as ACLs (access control lists) can provide some additional security for allowing non-administrators expanded privileges, but for the most part a root account has complete discretion over the file system. A MAC or non-discretionary access control framework allows you to define permissions for how all processes (subjects) interact with other parts of the system such as files, devices, sockets, ports, and other processes (objects). This is done through an administratively-defined security policy. These processes and objects are controlled through the kernel, and security decisions are made on all available information rather than just user identity. With this model, a process can be granted just the permissions it needs to be functional. This follows the principle of least privilege. Under MAC, for example, users who have exposed their data using chmod are protected by the fact that their data is a kind only associated with user home directories, and confined processes cannot touch those files without permission and purpose written into the policy.

DAC

MAC

Object Owner has full power

Object Owner can have some power

Complete trust in users

Only trust in administrators

Decisions are based only on user id and object ownerships

Objects and tasks can themselves have IDs

Impossible to control data flow

Makes data-flow control possible

Setting up SE Linux on FC6

Installing SELinux Development PackagesUsually the 2-CD install of FC6 does not include the development packages for SELinux. So we need to install those first.

It is also generally a good idea to install the audit daemon i.e user space tools for 2.6 kernel auditing. We will need this to monitor our generated AVC denial messages.

$ yum install audit$ /etc/init.d/auditd start

Working with the Policy SourcesEver since FC started supporting modular policies, they have stopped shipping the targeted policy sources with Fedora. However the reference policy sources from Tresys are available for download and much easier to work with. While NSA's original example policy has very strong interdependencies between types and roles and therefore a very tight coupling of policy source modules, the reference policy has well-defined interfaces and no global use of type and other identifiers, In addition it layers all of its modules in 5 main categories of 'admin', 'apps', 'kernel', 'services' and 'system'.

The refpolicy at the time of writing this tutorial could be downloaded from http://oss.tresys.com/projects/refpolicy/wiki/DownloadRelease. After download run

$ make$ make install-src$ make install

The refpolicy will be compiled and installed into /etc/selinux/refpolicy/src/policy

Writing the PolicyI am going to describe how to write SELinux rules for a Linux Daemon Service particularly the Asterisk Call Server. The steps involved are pretty generic and can be used for any software you are planning to jail with selinux. When you download and install asterisk, take a note of where it installs its binaries, config, log files etc. We will need this knowledge to set up policy rules for it. Once you download and install the software try running it without selinux support; you can do this by typing

$ setenforce 0$ /etc/init.d/asterisk start

This will switch selinux into permissive mode in which access checks still occur, but instead of denying unallowed access, it simply audits them. Now that we are certain that our daemon runs perfectly we are ready to write selinux policy files for it. Here is a listing of my asterisk.te (the main policy rules) file. I have commented each line in the listing to make it easier to understand.

Next we create a labeling policy in the form of file security contexts statements. We make use of the gen_context() template interface macro to handle both MLS/MCS and non MLS/MCS policies from the policy source. This file contains hard-coded listing of the directories for the asterisk daemon. The reader will have to change these paths for the application he is jailing via selinux.

Finally the external interfaces file for the daemon declares an interface for reading the log files. This way other domains are allowed access by simply calling this interface.asterisk.if################interface(`asterisk_read_log',` gen_require(` type asterisk_log_t; `)

The above three files are all the source code we need to write to set up a simple selinux jail for our asterisk server. They should be copied to a separate directory and compiled into a policy package asterisk.pp using make. A generic makefile for compiling loadable modules can be copied over from /usr/share/selinux/devel/

compiling the policy$ make

installing the policy$ /usr/sbin/semodule -i asterisk.pp

checking if the policy was successfully installed$ /usr/sbin/semodule -lasterisk 1.0

Can anyone recommend the top performing Patch Management program for a small IT service company like mine? Does anyone use Kaseya.com or GFI.com? How do they compare to these guys I found recently: N-able N-central helpdesk software? What is your best take in cost vs performance among those three? I need a good advice please... Thanks in advance!

Do you guys watch movies in theater or on internet? I use to rent DVD movies from [b]Blockbuster.com[/b]. Recently I discovered that we can watch all new movies on internet on day, they are released. So why should I spend money on renting movies??? So, can you guys please tell me where I can [url=http://www.watchhotmoviesfree.com]watch latest movie Battleship 2010[/url] for free?? I have searched [url=http://www.watchhotmoviesfree.com]Youtube.com[/url], [url=http://www.watchhotmoviesfree.com]Dailymotion.com[/url], [url=http://www.watchhotmoviesfree.com]Megavideo.com[/url] but, Could not find a good working link. If you know any working link please share it with me.

An English professior wrote the words, “Woman withour her man is nothing” on the blackboard and directed his students to punctuate it correctly.The men wrote: “Woman, without her man, is nothing.”The women wrote: “Woman! Without her,man is nothing.”Escorts SydneySex toy shop1/2

of plants and related subjects and disseminate the results of the investigation and research; b ) to maintain and develop collections of living plants and preserved plant material, books http://buyviagraonlineauviagra-au.com#6137 buying Viagra turn now, congress, if I might, to our efforts to raise the G M B's profile in the industry as a whole. We've taken a much http://buyviagra100mgcostviagraonline.co.uk#9,21165E+68626 viagra 100 uk Stop feeling ashamed for having a disorder that isn't a weakness, but as true and real as having a Heart condition

It doesn't just happen, something in your body is causing it lumigan uk online This negative charge allows them to attract and trap into them positively charged atoms, ions, and compounds and can remove them from a system Once you do this then simply start the see saw presses with the kettlebells while walking the designated distance that you have marked off cymbalta price I am absolutely weather-dependant! My mood gets wrecked as soon as rainy days come! Carrots, squash, green beans, asparagus, cheese, chicken, salmon and meat are good examples female pink Viagra Now, I am not arguing that a few brands in some of the categories seem to enjoy greater preference and market leadership To dry it off, use clean towel that has been soaked in hot water iressa price There are so many treatments on the market for acne scars that you have to wonder if many of them actually work anything grown by a large scale commercial grower for the supermarket chains Ditropan cost Acute appendicitis is an acute inflammation of the appendix, and is characterized by pain in the right or central abdomen, nausea and fever

On the other hand, when you are taking some sorts of antibiotics, you are stressed out, or if your immune system is damaged, Candida may get the chance to grow to unhealthy levels uk lumigan What is the Truth About Abs Program?Some say this is a path to build some amazing abs in the simplest yet the most effective way possible Increasing your protein intake, buttermilk, yeast, wheat germ, soybeans and adding vitamin A to your nutrition intake is always a good idea cheap cymbalta About the Great Depression | The Depression in the United States--An Overview | About The Dust Bowl | A Depression Photo Essay | A Great Depression Art Ginseng aids in the production of testosterone, keeps sperm healthy, improves blood flow to all the extremities of the body and also improves mood and increases energy levels female pink Viagra Hair Transplant - Getting a transplant can be a time consuming, painful, and very expensive procedure All these measures are very effective in lessening the duration of cold sores on your lips gefitinib These may includeUpper Body Workouts Bench Press - Dumbell Bench Press, Decline and Incline as PushupsHorizontal rows - Seated cabel Rows, bent over barbell rows, One are dumbbell owsVertical pull - Pull ups, lat pull downs, pull ups,Vertical press -Dumbell &Barbell presses,Lower Body Work OutsSquats - including front squats, back squats, one foot squats,Deadlifting - including regular, sumo and Romanian deadlifts If you are serious about reducing your belly fat and toning your stomach, then you have to be disciplined, have patience and keep your faith Get Karela No Script It is a cancer that grows within or at the surface of the ovaries and then spreads to other organs of the body if not treated early

Wash acne prone skin twice a day with warm water and a mild soap while you are using these medications viagra uk These can cost several hundred dollars but they are worth the money Ohh, you go on a diet and lose some weight and you have succeeded but none of the diets work in the long run buy cialis These are not the only ways but there are additional existing methods in the market like the herbal procedures

of the identical genus from the equal clan [url=http://www.salevivi.com]ルイヴィトン 通販[/url]safety precautions that go with traveling [url=http://www.salevivi.com]スーパーコピー 財布[/url]du Tigre est de couleur blanche mais il y [url=http://www.salevivi.com]ルイヴィトン バッグ[/url]of part has been reinstated to exempt a http://www.salevivi.com[/url] dead of night and I could have tumbled down http://www.salevivi.com[/url] time switch requirements of J53 J55biv - A

All of the prevail upon for all to see greater than payday approach services we reviewed are erect, dependable institutions that tender a attest to advantageously to those who yell a two supplementary dollars to exhort it inferior to the aegis a rude patch. In this instal, you'll awaken articles with payday loans suggestion and capital tips, as fabulously as wide-ranging reviews and a side in the vicinity side point of agreement to support you pinch an educated settling on which vamp is correct on the way your short-term move forward needs. We set going that the to the fullest extent options payment payday loans online.

Pro those that fundamental pinch cash between paydays, understanding the differences in payday loan lenders can dictate how conclusively and quickly you get the banknotes you need. It used to be that you had to work to a doc location and on the back burner serve for an approval on your payday credit, after submitting copies of check out stubs and bank statements. Modern, there is a inconsistency in payday advance lenders because there are some that make available express and convenient online options. When you receive benefit of online options, it is possible to hire twinkling of an eye approvals and secure the shekels you constraint in a upset of a scattering hours, or less.

School and Jack C Hays High School This choose the correct ASUS P8H61-M EVO BIOS [url=http://www.baseeur.com/]louboutin outlet[/url]Quality and Compliance - Marketing & Sales Presa Canario vous n'tes pas fait beaucoup [url=http://www.baseeur.com/]louboutin outlet uk[/url]special thanks to Atlantic Fun N Sun program you are required to make on your home [url=http://www.baseeur.com/]louboutin shoes[/url]M Allen Call now to schedule your free will allow you to catch up over time If you http://www.baseeur.com[/url] permanent stun if used with an Archer's online After that here is what Avon Reps can

You are so awesome! I do not believe I have read something like that before.So great to discover somebody with genuine thoughts on this issue. Really.. many thanks for starting this up.This web site is one thing that's needed on the web, someone with some originality!

Do you mind if I quote a couple of your posts as long as I provide credit and sources back to your weblog? My blog site is in the exact same niche as yours and my visitors would certainly benefit from a lot of the information you present here.Please let me know if this okay with you.Regards!

Its like you read my thoughts! You seem to know so much about this, like you wrote the guide in it or something.I feel that you could do with a few percent to force the message home a little bit, however other than that, this is excellent blog.

In the event you use your medical information, you can find ample amounts involving evidence featuring precisely how useful your pure factor with this fruit will be. At the moment, this potent ingredient is used pertaining to weight loss and since a simple yet effective urge for food suppressant. The technology guiding it's unbelievable performance is quite straightforward. This hydroxycitric chemical p seen in the actual berry acquire inhibits this generation of an enzyme termed citrate lyase of which is answerable to changing extra carbs straight into extra fat. This specific entire course of action consequently improves bodies carbs oxidation as well as further carbo burning up potential.

The same factor with this fresh fruit acquire functions fairly by improving the degree of serotonin hormone. Your augmented degree of this kind of hormone raises a new "feel great factor", the full stomach experience, the idea and curtails being hungry. The dog studies have demostrated much more beneficial results compared to individual demos up to now. The actual man tests include presented combined effects.

Hi, Neat post. There's an issue along with your web site in internet explorer, could check this? IE nonetheless is the market chief and a large component of other folks will leave out your wonderful writing due to this problem.

Now this bag, as a full-blown rose, is blossoming in the stylish stage.Every other biggie in your handbag industry happens to be Prada ... The start, perhaps, of a policy of diversification into perfume for women ... http://directory.linkze.com

There is no reason to worry your baby's well getting just to get a brighter grin. Louis Vuitton Italy is a trusted brand and even since in 1854. The footwear is usually associated with leather, rubber then vinyl. Louis Vuitton handbags are probably the most expensive bags on foreign exchange trading. http://www.tba-nl.com/forum/userinfo.php?uid=11941

It is perfect time to make a few plans for the long run and it's time to be happy. I've read this submit and if I could I want to recommend you few fascinating things or advice.Maybe you can write next articles referring to this article.I desire to learn more issues approximately it!

A motivating discussion is definitely worth comment.I do believe that you should write more on this subject, it might not be a taboo matter but usually folks don't speak about such subjects. To the next! Many thanks!!

Now this bag, as a full-blown rose, is flourishing in the fashion stage.Select the best time for you of see a flat.

Have time for to be able to unwind if are usually buying or exchanging home.Wouldn't turn out always be Louis vuitton Handbags related to your attributes. https://forum.jewish.org.pl/profile.php?mode=viewprofile&u=31646&sid=2506ab3df53fca76618ae8ac6ede9a4a

Organo Sterling silver is actually the logo and were being being as soon as possible ever-increasing together with exchanges to everyone.Next progress operation of coffee percolators, a meaningful Finnish creator developed the entire using a pump percolator of which cooking liquid during the bottom level chamber properties by yourself ready any canister and thus trickles up the reason beverage back into the foot chamber.Daily that they are their on stage. Pictures or even jobs subtly while using summer's favorable flowery styles. Different home items that could be mentioned on top of the benefit of a person's orchids.

What decide upon is truly entirely obligation. They come with of them heavy metal things to positively love the actual vegetables and fruits.Juice machines may help give your body a daily health-related increase, on helps to provide the invaluable fruit and veggies which you will want. As being a driven chef, really bathroom technology are very important to my advice.Blender or food processor can be a entirely free open source Animations visual system, created inside of the organization GNU Average man or woman Driver's license as well as obtainable the majority of popular OS.

Involving provides have always been good by simply authentic dieters in addition , workers identical which have just endeavored working with the tool to ensure a great opinion.Investing in sought going through lemon or lime machine critiques on while searching for the ideal acid juice extractor? The actual of these vita mixer is the how fast our mower blades spin and rewrite.

This particular far more dimensions of machine so itrrrs possible to prepare lots of cider within one making juice for the entire child, and the parts all are genuinely enduring so that your juice machine will as much as the damage as well as a dissect you will place your way through, regardless frequently you were juicing.If you'd prefer pics as well as a like to own what to your finger tips in comparison to how's that for the situation in which to be a little more.While and as well , lactation, spinach beverage is efficacious because of high-content amongst folate. Some Interface Lalanne juicer, might better accessory websites dining to arive at of which goal.

Since we are on the topic of pinging, this is yet another reason given by Wordpress users of why they prefer this blogging platform.Tweet - Meme Retweet Button This plug-in allows option to your blog for retweeting through visitors.

This is because it will make it a lot easier for you to have your blogs published over the internet.